CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14558 vulnerabilities reference this CWE, most recent first.
GHSA-XFXP-CQ7J-44H5
Vulnerability from github – Published: 2025-11-25 09:31 – Updated: 2025-11-25 09:31The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
{
"affected": [],
"aliases": [
"CVE-2025-13386"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-25T08:15:50Z",
"severity": "MODERATE"
},
"details": "The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027options_update\u0027 function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin\u0027s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"id": "GHSA-xfxp-cq7j-44h5",
"modified": "2025-11-25T09:31:24Z",
"published": "2025-11-25T09:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13386"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/social-images-widget/tags/2.1/class-social-images-widget-settings.php#L44"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/social-images-widget/trunk/class-social-images-widget-settings.php#L44"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XG34-8QVC-J4HH
Vulnerability from github – Published: 2022-05-13 01:21 – Updated: 2022-05-13 01:21Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
{
"affected": [],
"aliases": [
"CVE-2019-0257"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-15T18:29:00Z",
"severity": "HIGH"
},
"details": "Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.",
"id": "GHSA-xg34-8qvc-j4hh",
"modified": "2022-05-13T01:21:12Z",
"published": "2022-05-13T01:21:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0257"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2728839"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106999"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XG4V-H682-43V2
Vulnerability from github – Published: 2025-11-13 12:31 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.2.
{
"affected": [],
"aliases": [
"CVE-2025-64265"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-13T10:15:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through \u003c= 23.2.",
"id": "GHSA-xg4v-h682-43v2",
"modified": "2026-01-20T15:31:55Z",
"published": "2025-11-13T12:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64265"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/nmedia-user-file-uploader/vulnerability/wordpress-frontend-file-manager-plugin-23-2-broken-access-control-vulnerability-2?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/nmedia-user-file-uploader/vulnerability/wordpress-frontend-file-manager-plugin-23-2-broken-access-control-vulnerability-2?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XG55-GX79-H9H6
Vulnerability from github – Published: 2023-06-07 03:30 – Updated: 2024-04-04 04:38The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.
{
"affected": [],
"aliases": [
"CVE-2021-4366"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-07T02:15:14Z",
"severity": "MODERATE"
},
"details": "The PWA for WP \u0026 AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.",
"id": "GHSA-xg55-gx79-h9h6",
"modified": "2024-04-04T04:38:30Z",
"published": "2023-06-07T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4366"
},
{
"type": "WEB",
"url": "https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XG58-75QF-9R67
Vulnerability from github – Published: 2024-11-25 19:35 – Updated: 2024-12-04 16:22Impact
For users with the following configuration:
- An allow policy that selects a Layer 3 identity and a port range AND
- A Layer 7 allow policy that selects a specific port within the first policy's range
then Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy.
This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16.
For reference, an example of a pair of policies that would trigger this issue is:
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: "layer-3-and-4"
spec:
endpointSelector:
matchLabels:
app: service
ingress:
- fromCIDR:
- 192.168.60.0/24
toPorts:
- ports:
- port: "80"
endPort: 444
protocol: TCP
and
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
name: "layer-4-and-7"
spec:
endpointSelector:
matchLabels:
app: service
ingress:
toPorts:
- ports:
- port: "80"
protocol: TCP
rules:
http:
- method: "GET"
path: "/public"
In the above example, requests would be permitted to all HTTP paths on matching endpoints, rather than just GET requests to the /public path as intended by the layer-4-and-7 policy. In patched versions of Cilium, the layer-4-and-7 rule would take precedence over the layer-3-and-4 rule.
Patches
This issue is patched in https://github.com/cilium/cilium/pull/35150.
This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive.
This issue is patched in Cilium v1.16.4.
Workarounds
Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.
Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cilium/cilium"
},
"ranges": [
{
"events": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.16.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52529"
],
"database_specific": {
"cwe_ids": [
"CWE-755",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-25T19:35:10Z",
"nvd_published_at": "2024-11-25T19:15:11Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nFor users with the following configuration:\n\n* An allow policy that selects a [Layer 3 identity](https://docs.cilium.io/en/v1.14/security/policy/language/#layer-3-examples) and a [port range](https://docs.cilium.io/en/stable/security/policy/language/#example-port-ranges) **AND**\n* A [Layer 7 allow policy](https://docs.cilium.io/en/latest/security/policy/language/#layer-7-examples) that selects a specific port within the first policy\u0027s range \n\nthen Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy.\n\nThis issue only affects users who use Cilium\u0027s port range functionality, which was introduced in Cilium v1.16.\n\nFor reference, an example of a pair of policies that would trigger this issue is:\n\n```\napiVersion: \"cilium.io/v2\"\nkind: CiliumNetworkPolicy\nmetadata:\n name: \"layer-3-and-4\"\nspec:\n endpointSelector:\n matchLabels:\n app: service\n ingress:\n - fromCIDR:\n - 192.168.60.0/24\n toPorts:\n - ports:\n - port: \"80\"\n endPort: 444\n protocol: TCP\n```\nand\n```\napiVersion: \"cilium.io/v2\"\nkind: CiliumNetworkPolicy\nmetadata:\n name: \"layer-4-and-7\"\nspec:\n endpointSelector:\n matchLabels:\n app: service\n ingress:\n toPorts:\n - ports:\n - port: \"80\"\n protocol: TCP\n rules:\n http:\n - method: \"GET\"\n path: \"/public\"\n```\n\nIn the above example, requests would be permitted to all HTTP paths on matching endpoints, rather than just `GET` requests to the `/public` path as intended by the `layer-4-and-7` policy. In patched versions of Cilium, the `layer-4-and-7` rule would take precedence over the `layer-3-and-4` rule.\n\n### Patches\n\nThis issue is patched in https://github.com/cilium/cilium/pull/35150.\n\nThis issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive.\n\nThis issue is patched in Cilium v1.16.4.\n\n### Workarounds\n\nUsers with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.\n\n### Acknowledgements\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for resolving this issue.\n\n### For more information\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.\n",
"id": "GHSA-xg58-75qf-9r67",
"modified": "2024-12-04T16:22:27Z",
"published": "2024-11-25T19:35:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52529"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/pull/35150"
},
{
"type": "PACKAGE",
"url": "https://github.com/cilium/cilium"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Cilium\u0027s Layer 7 policy enforcement may not occur in policies with wildcarded port ranges"
}
GHSA-XG5F-PRH7-R529
Vulnerability from github – Published: 2022-05-24 17:18 – Updated: 2022-05-24 17:18An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests.
{
"affected": [],
"aliases": [
"CVE-2019-20801"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-18T00:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application\u0027s file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user\u0027s data) via cross-origin requests.",
"id": "GHSA-xg5f-prh7-r529",
"modified": "2022-05-24T17:18:01Z",
"published": "2022-05-24T17:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20801"
},
{
"type": "WEB",
"url": "https://apps.apple.com/us/app/documents-by-readdle/id364901807"
},
{
"type": "WEB",
"url": "https://logicaltrust.net/blog/2019/12/documents.html#authorization"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XG6P-PPF2-6WJ6
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Push Notifications: from n/a through 1.1.9.
{
"affected": [],
"aliases": [
"CVE-2025-50028"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-16T12:15:28Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Push Notifications: from n/a through 1.1.9.",
"id": "GHSA-xg6p-ppf2-6wj6",
"modified": "2026-04-01T18:35:48Z",
"published": "2025-07-16T12:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50028"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ultimate-push-notifications/vulnerability/wordpress-ultimate-push-notifications-1-1-9-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XG8M-CJFG-G3JW
Vulnerability from github – Published: 2025-09-05 15:31 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in ThemeArile Consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Consultstreet: from n/a through 3.0.0.
{
"affected": [],
"aliases": [
"CVE-2025-58813"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-05T14:15:52Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in ThemeArile Consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Consultstreet: from n/a through 3.0.0.",
"id": "GHSA-xg8m-cjfg-g3jw",
"modified": "2026-04-01T18:36:04Z",
"published": "2025-09-05T15:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58813"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/consultstreet/vulnerability/wordpress-consultstreet-theme-3-0-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XG9F-423R-VCP9
Vulnerability from github – Published: 2026-04-08 06:31 – Updated: 2026-04-08 06:31The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
{
"affected": [],
"aliases": [
"CVE-2026-4299"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T05:16:06Z",
"severity": "MODERATE"
},
"details": "The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the \u0027wp-mainwp-stream-heartbeat\u0027 data key.",
"id": "GHSA-xg9f-423r-vcp9",
"modified": "2026-04-08T06:31:27Z",
"published": "2026-04-08T06:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4299"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php#L182"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php#L44"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php#L182"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php#L44"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3490157%40mainwp-child-reports\u0026new=3490157%40mainwp-child-reports\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4141bd-cd3f-44e9-b423-be03377a342d?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGF2-5W76-R5JG
Vulnerability from github – Published: 2023-05-25 15:30 – Updated: 2026-02-23 09:31Missing access permissions checks in M-Files Client before 23.5.12598.0 allows elevation of privilege via UI extension applications
{
"affected": [],
"aliases": [
"CVE-2023-2480"
],
"database_specific": {
"cwe_ids": [
"CWE-280",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-25T14:15:10Z",
"severity": "HIGH"
},
"details": "Missing access permissions checks in M-Files Client before 23.5.12598.0 allows elevation of privilege via UI extension applications",
"id": "GHSA-xgf2-5w76-r5jg",
"modified": "2026-02-23T09:31:18Z",
"published": "2023-05-25T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2480"
},
{
"type": "WEB",
"url": "https://empower.m-files.com/security-advisories/CVE-2023-2480"
},
{
"type": "WEB",
"url": "https://https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2480"
},
{
"type": "WEB",
"url": "https://product.m-files.com/security-advisories/cve-2023-2480"
},
{
"type": "WEB",
"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2480"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.